UBUNTU-CVE-2026-120637: Medium severity ubuntu/libcgi-pm-perl vulnerability

Published Nov 4, 2026

Updated

CGI versions before 5.00 for Perl take request parameters from the process command line arguments for an unrecognised REQUESTMETHOD. For a REQUESTMETHOD such as OPTIONS, CGI falls through to its offline debugging mode, which is on by default, and builds the parameters and pathinfo from the process's command line arguments.

Affected Software

7 affected components

ubuntu/libcgi-pm-perl*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade CGI for Perl to a version that resolves this vulnerability.
Fixed in 5.00

Event History

Nov 4, 2026

CVE Published

via OSV·12:17 AM

Data Sourced

via OSV·12:17 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are exposed?

Deployments using CGI versions before 5.00 for Perl are exposed when they process requests with an unrecognised REQUEST_METHOD, such as OPTIONS. The affected package is ubuntu/libcgi-pm-perl.

Is a default configuration affected?

Yes. The offline debugging mode that triggers this behavior is enabled by default.

What does an attacker need to do to trigger the issue?

An attacker needs to send a request using an unrecognised REQUEST_METHOD, such as OPTIONS. CGI then falls back to offline debugging mode and derives parameters and path_info from the process command-line arguments.

UBUNTU-CVE-2026-120637: Medium severity ubuntu/libcgi-pm-perl vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed?

Is a default configuration affected?

What does an attacker need to do to trigger the issue?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

Is a default configuration affected?

What does an attacker need to do to trigger the issue?